4d62ce3098af59ffae998fc1898b77a8d457bd62d214ba89a0243c76f44f82ee

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 22:16

Target

aa4b5e3127433cf3190144c5581b9c50.exe
Size

9KB
MD5

aa4b5e3127433cf3190144c5581b9c50
SHA1

301f9436e6d35547c0a1ab0773cb3cbd66aa5e71
SHA256

4d62ce3098af59ffae998fc1898b77a8d457bd62d214ba89a0243c76f44f82ee
SHA512

1c60166fc83a69a6f46b07e8c8659531e62f23012f59736c233faad7fc4a2e08f1d939c282ca7d6af4df04ed8783eba878889a97361c6857148f19521d80315b
SSDEEP

192:xBksub9MuIrKeMZZ3Q93Vnjdwqzo33a0x:ulWKeMcFnhwqcna0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	aa4b5e3127433cf3190144c5581b9c50.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2660	2124	aa4b5e3127433cf3190144c5581b9c50.exe	29
PID 2124 wrote to memory of 2660	2124	aa4b5e3127433cf3190144c5581b9c50.exe	29
PID 2124 wrote to memory of 2660	2124	aa4b5e3127433cf3190144c5581b9c50.exe	29

C:\Users\Admin\AppData\Local\Temp\aa4b5e3127433cf3190144c5581b9c50.exe
"C:\Users\Admin\AppData\Local\Temp\aa4b5e3127433cf3190144c5581b9c50.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 904
  2⤵
  PID:2660

memory/2124-0-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download
memory/2124-1-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-2-0x000000001B360000-0x000000001B3E0000-memory.dmp

Filesize
512KB

Download
memory/2124-3-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-4-0x000000001B360000-0x000000001B3E0000-memory.dmp

Filesize
512KB

Download